[PR #1968] fix DTVCC: Heap Buffer Overflow & Out-of-Bounds Read

**Original Pull Request:** https://github.com/CCExtractor/ccextractor/pull/1968 **State:** closed **Merged:** Yes ---  **In raising this pull request, I confirm the following (please check boxes):** - [x] I have read and understood the [contributors guide](https://github.com/CCExtractor/ccextractor/blob/master/.github/CONTRIBUTING.md). - [x] I have checked that another pull request for this purpose does not exist. - [x] I have considered, and confirmed that this submission will be valuable to others. - [x] I accept that this submission may not be used, and the pull request closed at the will of the maintainer. - [x] I give this submission freely, and claim no ownership to its content. - [x] **I have mentioned this change in the [changelog](https://github.com/CCExtractor/ccextractor/blob/master/docs/CHANGES.TXT).** **My familiarity with the project is as follows (check one):** - [ ] I have never used CCExtractor. - [ ] I have used CCExtractor just a couple of times. - [ ] I absolutely love CCExtractor, but have not contributed previously. - [x] I am an active contributor to CCExtractor. --- ### Description fixed critical vulnerabilities in the DTVCC (CEA-708) decoder **Issues Fixed:** 1. **Heap Buffer Overflow in `dtvcc_process_data`** - Trigger: Malformed CEA-708 streams with packet length > 128. - Fix: Added bounds check using `CCX_DTVCC_MAX_PACKET_LENGTH`. 2. **Out-of-Bounds Read in `dtvcc_process_current_packet`** - Trigger: Extended header (service_number 7) read beyond packet buffer. - Fix: Added length check to stop processing truncated extended headers. **Impact if unpatched:** - Heap memory corruption. - Undefined behavior while processing malformed DTVCC streams. - Potential crash during caption extraction. **Testing:** - Verified packets exceeding `CCX_DTVCC_MAX_PACKET_LENGTH` are safely ignored. - Verified truncated extended headers do not cause memory over-read. - Confirmed normal streams continue to decode correctly with no regression. fixed #1966

claunia commented

2026-01-29 17:23:48 +00:00

Owner

Original Pull Request: https://github.com/CCExtractor/ccextractor/pull/1968

State: closed
Merged: Yes

In raising this pull request, I confirm the following (please check boxes):

I have read and understood the contributors guide.
I have checked that another pull request for this purpose does not exist.
I have considered, and confirmed that this submission will be valuable to others.
I accept that this submission may not be used, and the pull request closed at the will of the maintainer.
I give this submission freely, and claim no ownership to its content.
I have mentioned this change in the changelog.

My familiarity with the project is as follows (check one):

I have never used CCExtractor.
I have used CCExtractor just a couple of times.
I absolutely love CCExtractor, but have not contributed previously.
I am an active contributor to CCExtractor.

Description

fixed critical vulnerabilities in the DTVCC (CEA-708) decoder

Issues Fixed:

Heap Buffer Overflow in dtvcc_process_data
- Trigger: Malformed CEA-708 streams with packet length > 128.
- Fix: Added bounds check using CCX_DTVCC_MAX_PACKET_LENGTH.
Out-of-Bounds Read in dtvcc_process_current_packet
- Trigger: Extended header (service_number 7) read beyond packet buffer.
- Fix: Added length check to stop processing truncated extended headers.

Impact if unpatched:

Heap memory corruption.
Undefined behavior while processing malformed DTVCC streams.
Potential crash during caption extraction.

Testing:

Verified packets exceeding CCX_DTVCC_MAX_PACKET_LENGTH are safely ignored.
Verified truncated extended headers do not cause memory over-read.
Confirmed normal streams continue to decode correctly with no regression.

fixed #1966

claunia added the pull-request label 2026-01-29 17:23:48 +00:00

claunia closed this issue

[PR #1968] fix DTVCC: Heap Buffer Overflow & Out-of-Bounds Read #2769

Description